hacker ezine on milw0rm

ZFO has released their latest e-zine (read: old school text file ). While infuriatingly juvenile most of the time, docs like this still hold a huge wealth of knowledge on both attackers and some of the things they do to gain and expand their access (and some of their really lame victims). It is unfortunate that people get pwned, but at least the rest of us can learn from others. I’d recommend scrolling through the zine once.

the story of a botnet herder

Herein lies the story of a botnet herder. I find these sorts of stories far more interesting than vague reports on data disclosures, akin to the difference between cheesecake and rice cakes.

We thankfully have a few trends available to us that help keep these threats in check. Greed, arrogance, stupidity. While some criminals make stupid mistakes out of their pursuit of money, there are many others who are more savvy than to be obvious and brazen with their tradecraft. I guess in another lifetime if I wanted to be a cyber criminal, I would follow a few non-technical steps:

  • tell no one, don’t brag
  • always respect your adversaries, don’t be sloppy or cocky
  • make enough money to be comfortable, don’t be greedy
  • wake up
  • twitter botnet

    I was pondering the point of Twitter again today. It is so much like IRC. If you step away and don’t read updates for a few days (or you have a really busy list you’re following!), there is no way to really catch back up on what was said or jump back into a conversation. In fact, you likely will miss reponses even directed to you! Just like stepping away from IRC and it continuing to scroll on by.

    So, I wonder when a botnet will use Twitter for command-and-control?

    securitywannabe: 10 myths of life in infosec

    The SecurityWannabe has posted one of the better lists I’ve seen in some time: 10 Myths About Life As An IT Security Professional. Some I wanted to pull out:

    4. You won’t learn as much as someone doing a “normal” IT job. Depending on your role in security, I find that we need to have some level of aptitude in everything IT, from scripting, to programming, to low level memory analysis, desktop troubleshooting, networking, packet analysis, web app coding and architecture, cc surveillance, wireless cracking, optimized scanning, manual scanning, and on and on. Even a jack-of-all-trades in an SMB may not know quite this much. And if we don’t know one of these topics, we know places and people to ask to get answers and self-teach.

    5. Your friends will disown you – IT security is geek – but not “cool” geek. One of the best parts is being able to relate to non-geeks. For instance, my parents and I can talk to each other on their level about data theft and credit card fraud risk, or the concerns about adopting wireless in their home or at work. I can’t talk to them about coding kickass C# apps, the newest developments in virtualization, how sexy the latest big iron is, or the most recent Ubuntu release. I once even had a roommate who thought her boyfriend was looking at too much porn. And let’s just say he couldn’t do anything to stop me from keeping her well informed indeed.

    An excellent list that I consider a must-read highlight so far this year.

    yet another list of livecds (yall?)

    Continuing my wiki cleanup is this list of LiveCDs with a security twist. Some of these are evolved (Auditor) while some are simply gone (Phlack). I even missed adding a few from earlier this year (Russix, Deft…)

    KnoppixSTDM is a Knoppix Security distribution. Sadly, it came out as version 0.1 and remains at that level. Knoppix has tons of documentation and tutorials, including this little bit on [http://blogs.ittoolbox.com/security/investigator/archives/quick-inspection-technique-for-windows-laptops-10094 mounting a Windows disk and doing some forensics].

    BackTrack is probably the most solid and most-maintained security-based live cd around right now. Extensive support for wireless and a very solid, matured distribution. This distro really has pretty much moved into the lead of security livecds, if there is such a thing.

    DamnVulnerableLinux (DVL) is a very vulnerable live cd and local installation distro that is designed to teach about security and insecurity through tutorials and providing an insecure Linux installation. Really sounds like a cool idea and on par with something ike WebGOAT or the Foundstone Hackme series of exercises.

    Helix is a currently maintained livecd with a forensics focus to it.

    Trinity Rescue Kit is also a forensics-based livecd.

    Pentoo is a Gentoo-based livecd for penetration testing and security.

    nUbuntu is an Ubuntu-based livecd. While not necessarily of a security focus, it is still a solid distro. The live-cd version can also be installed locally.

    Auditor has been succeeded by BackTrack, but is still a highly documented auditing and security livecd.

    Nullbound looks like an in-line Snort/IDS implementation in a livecd.

    OWASP Live CD Project has not really kicked off yet, but I’m hoping they are able to put something out.

    Ultimate Windows Boot CD is not really a livecd in the strictest sense, but it is as close as it gets for Windows.

    Phlack is another of the “original” few security livecds from a number of years back. Development has stalled, but may still get going on version 0.4.

    SecureDVD is a full DVD loaded with 10 security livecd distros. This hasn’t really been maintained, but is an excellent source and reference for some other livecd distros.

    Slax is a Slackware-based livecd.

    i h4x ur pr1ntrz

    I am cannibalizing some sections of my wiki to place as entries on this site simply to reorganize some stuff. Here are some links to information about network printer hacking.

    Irongeek has a very thorough and well-written series of walk-throughs on playing with networked printers.

    Phenoelit [old link] has done some impressive work in the past, which includes their excellent HiJetter tool.

    Coincidentally, this same topic just came up on the pen-test mailing list on SecuityFocus. Perhaps some links there will someday be useful.

    logs as proof of incompetence

    Anton Chuvakin throws down a doozy in discussing “Reverse Compliance or ‘Logs as Proof of Incompetence?'” Granted, he was inspired elsewhere, but he’s the first I read on this.

    What if you keep so few logs that no one can prove you’ve been negligent beyond just not keeping logs? What if so few logs are kept, you don’t even need to know you’ve been hacked 2 years ago? We don’t know where these White House emails have gone, it must be our incompetence. Slap our wrists and let’s please move on…

    if pci remains costly, we’ll all simply run away from the beast

    PCI is a beast, and continues to blot out the sun with its harpy wings, wheeling in the desert sky, slowly waiting to pounce on the weak. Between concerns over requirement 6.6, code reviews, WAFs, and so on…where will this lead us? Let me play annoying Devil’s Advocate a bit.

    Well, if you’re a web development shop, why go through all the friggin trouble? Rather than process and store any payment information, hire out to someone like PayPal. When you’re ready to check out, click the PayPal button which transfers you over to the PayPal site along with whatever transaction information you need. User logs in there, performs transaction there, and completes it there. Let the PayPal-type sites deal with PCI.

    This way, every web dev shop won’t need a WAF or layers of security or code reviews. Not that I think they should all ditch such efforts, I just feel such efforts are too idealistic for our economic world. I know I’ve yet to hear a developer or developer manager who has any interest in spending effort, time, or money on an SDLC beyond what it takes to roll out product faster and with higher quality (quality not being defined in terms of security other than the most basic stuff like SSL support).

    Of course, this means that while web shops won’t process your credit information or store it, they can and likely will store everything else about you. But, hey, that doesn’t fall under PCI!

    the epidemic of useless reports and lack of real disclosure information

    It might seem like there is an epidemic of information disclosures in recent years. I maintain there is a companion epidemic: one of silence about the reason for these intrusions and disclosures. This prevents anyone from really learning how to improve by any other means beyond having a finger waggled at us/them or a painful ruler smacked across our cheek. (I sometimes wonder if we’re going to be stuck in a silo no matter what our efforts…)

    The Daily Camera has a story about the disclosure of data on 9,500 persons from the University of Colorado (dig the off-beat green-tinted site).

    Hilliard said three computers [one laptop, two desktops] in the Division of Continuing Education and Professional Studies were compromised by a “very complicated hack” that was discovered Thursday afternoon.

    One man’s “complicated hack” is another man’s obviously gaping hole. Useless information.

    “We think they were compromised by digital intrusion with some sort of hack,” Hilliard said, noting there is “no direct evidence the data has been taken and used for nefarious purposes.”

    I’m done being nice about these things. No shit you don’t have any direct evidence of wrong-doing. If someone breaks into my house and steals my gun, I can cover my eyes and say “I have no proof a crime is being committed with it!” By the way, no kidding, “some sort of hack…” amazing.

    According to Hilliard, none of the computers was [sic] supposed to have personal information stored on it, following a policy change CU implemented last fall after someone hacked into a computer issued to the College of Arts and Sciences’ Academic Advising Center.

    Policies don’t actually stop anything, just like education. Both are necessary, but neither will guarantee anything. Kinda like that 35 mph sign on the road that I always drive past at 42 mph.

    my 2008 gaming system is done

    Last week I finished putting everything together for my 2008 gaming machine. It’s been about 6 years since my last gaming machine, so I was due for an upgrade. The parts list is saved on my wiki. Special props to NewEgg, my hardware supplier for many, many years. And I added PetrasTechShop.com as my water cooling parts supplier. Excellent service at both, and absolutely no bad parts this go-around! My source of most information comes from the HardForum.

    Total cost is probably somewhere around $1100-1300 (not including monitors), with probably the largest chunk being all the water cooling parts. Six years ago, I saved a lot by putting the system together myself, but these days gaming boutiques and other computer outlets have pretty damn good pricing, and I likely didn’t save all that much off a comparably performing pre-built system. But few of them do water cooling at all without a premium cost. So to get silence with water, I did save a bundle.

    The system is running on WinXP 32-bit right now. I know, I lose some performance, but I didn’t want to spend any huge time (getting everything to work and run) or money (a real, honest license [damn Microsoft]), until I hear more details on when Windows 7 will be out and how long Windows XP will be extended. If they start to overlap, I’m just going to skip Vista like I skipped ME. (DirectX 10 support/availability may make a difference when Starcraft II comes out.)

    Everything works great. Wow sits at 60 fps no matter what I do (including fraps recording), and isn’t taxing the system at all. Temperatures stay barely above room temp, even after hours of gaming, so I’m very happy with the water cooling.

    I ended up water cooling my GPU as well. When powering up system components the first time, I was terribly disappointed with the noise from my HD-3870 fan. With that gone, the system hums away unnoticed.

    What would I do differently with my setup if I knew what I know now:

  • Bigger case. It took a lot of experimenting to get everything in a good position in the midtower case I got. I lucked out with the top fan (didn’t have to drill more holes to mount the top radiator), but I got screwed with the hard drive cage and other crap in the lower right corner of the case. I moved what I could, but the pump still is at a non-optimal angle. Also, I wouldn’t mind making a bigger hole on the top and mounting the radiator on the inside of the top of the case rather than the outside. Alas, not a huge deal.
  • Bought all the water cooling parts at once. Since this was my first time parting water cooling out, I did it in very small orders. I think 6 total! I would have planned a bit better too: gotten a flow indicator somewhere in the line, better fill setup (currently the only thing still in progress) so I don’t even have to open the case to add liquid (not that I will need to very often), and maybe a drain port if I ever upgrade stuff and need to remove parts. As it is, I’ll need to turn the case upside down and around to fully drain it.
  • hoff flashes his virtualizations to innocent pci

    Every other post Hoff makes is packed with information that is way over my head, oftentimes making me lightheaded. But he continues to have great posts in between the bleeding-edge ones. I took two points from a recent post of his on the conflict between virtualization and PCI compliance (2.2.1 which wants single roles for a server may fail all host servers that “serve” multiple guests of various purposes, although I *might* argue the host serves the single purpose of hosting virtual servers).

    1. Auditors and checklists will always be behind new technology.

    2. Auditors need to know what the crap they’re talking about.

    If they make certain observations on their audits, they know they need to field questions that may be as obvious as “how do we secure or satisfy this virtualization piece you dinged us on?” If auditors can’t answer questions like that, I wouldn’t be surprised if they decide to fluff through and try not to touch it, further miring checklists behind technology, and further not providing much real security. It all comes down to training and hands-on exposure to technology.

    This is a chicken-egg scenario. Can you implement and mature new technology or do you have to wait until compliance, which may mean needing to implement and mature it to learn it…
    This is made futher painful because this contradicts what I consider a rule of IT and security: Technology moves forward. There is no holding it back, putting on the brakes, or waving the yellow flag of security. It inevitably moves forward. (Fine, we can hold some things back a bit, but eventually it simply will happen.) This is especially true if new technology is economically beneficial. Companies don’t need to think bleeding-edge, but they can’t afford to be lagging badly behind the curve.